CVE-2017-10299: Infoleak

Published Oct 19, 2017

Updated

Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Affected Software

4 affected components

Oracle Agile Product Lifecycle Management Framework=9.3.5

Oracle Agile Product Lifecycle Management Framework=9.3.6

Oracle Agile Product Lifecycle Management=9.3.5

Oracle Agile Product Lifecycle Management=9.3.6

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Event History

Oct 19, 2017

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-10299?

CVE-2017-10299 is considered a critical vulnerability that can be easily exploited by low privileged attackers.

How do I fix CVE-2017-10299?

To fix CVE-2017-10299, upgrade Oracle Agile PLM to versions 9.3.7 or later as recommended by Oracle.

What systems are affected by CVE-2017-10299?

CVE-2017-10299 affects Oracle Agile PLM versions 9.3.5 and 9.3.6.

Can CVE-2017-10299 be exploited remotely?

Yes, CVE-2017-10299 can be exploited remotely via HTTP by an attacker with low privileges.

What is the impact of CVE-2017-10299 on Oracle Agile PLM?

The impact of CVE-2017-10299 allows unauthorized access and potential compromise of Oracle Agile PLM.